{"cve":"CVE-2020-14370","nvd":{"published":"2020-09-23T13:15:15.563","modified":"2026-06-17T02:54:38.457","status":"Modified","description":"An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.3},"cwes":["CWE-212"],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=1874268","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6BPCZX4ASKNONL3MSCK564IVXNYSKLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y74V7HGQBNLT6XECCSNZNFZIB7G7XSAR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4Y2FSGQWP4AFT5AZ6UBN6RKHVXUBRFV/","https://bugzilla.redhat.com/show_bug.cgi?id=1874268"],"products":["fedoraproject:fedora","podman_project:podman","redhat:enterprise_linux","redhat:openshift_container_platform"],"source":"nvd","synced_at":"2026-10-19T21:09:53.489947993+00:00"},"epss":{"cve":"CVE-2020-14370","score":0.01402,"percentile":0.72541,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-c3wv-qmjj-45r6","url":"https://osv.dev/vulnerability/GHSA-c3wv-qmjj-45r6","summary":"Information disclosure in podman","modified":"2024-06-04T16:56:43.819001Z","packages":[{"ecosystem":"Go","name":"github.com/containers/podman/v2","purl":"pkg:golang/github.com/containers/podman/v2","ranges":["<2.0.5"],"fixed":["2.0.5"]}]},{"id":"GO-2024-2766","url":"https://osv.dev/vulnerability/GO-2024-2766","summary":"Information disclosure in podman in github.com/containers/libpod","modified":"2026-03-03T04:55:03.194753Z","packages":[{"ecosystem":"Go","name":"github.com/containers/libpod","purl":"pkg:golang/github.com/containers/libpod","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/containers/libpod/v2","purl":"pkg:golang/github.com/containers/libpod/v2","ranges":["<2.0.5"],"fixed":["2.0.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}